Offis - vulnerabilities (CVEs)

36 CVEs in 1 products, 7 in the last 30 days, newest from 2026-10-08.

Products

• Dcmtk - 36 CVEs

Newest CVEs of Offis

• CVE-2026-44038 - CVSS 4.8 (medium), 2026-10-08: A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an…
• CVE-2026-44037 - CVSS 6.8 (medium), 2026-10-08: Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in…
• CVE-2026-44036 - CVSS 6.8 (medium), 2026-10-08: Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter…
• CVE-2026-44035 - CVSS 6.8 (medium), 2026-10-08: Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service…
• CVE-2026-44034 - CVSS 4.8 (medium), 2026-10-08: A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63…
• CVE-2026-44033 - CVSS 6.8 (medium), 2026-10-08: Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows…
• CVE-2026-44031 - CVSS 8.7 (high), 2026-10-08: Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker…
• CVE-2026-97059 - CVSS 8.8 (high), 2026-09-24: DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer…
• CVE-2026-12805 - CVSS 6.3 (medium), 2026-06-21: A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a…
• CVE-2026-10194 - CVSS 6.3 (medium), 2026-05-31: A weakness has been identified in OFFIS DCMTK 3.7.0. This affects the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages of the file…
• CVE-2026-5663 - CVSS 9.8 (critical), 2026-04-06: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file…
• CVE-2025-14841 - CVSS 4.8 (medium), 2025-12-18: A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function…
• CVE-2025-14607 - CVSS 6.3 (medium), 2025-12-13: A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file…
• CVE-2022-4981 - CVSS 5.5 (medium), 2025-10-21: A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the…
• CVE-2020-36855 - CVSS 5.5 (medium), 2025-10-21: A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation…
• CVE-2025-9732 - CVSS 7.8 (high), 2025-08-31: A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the…
• CVE-2025-2357 - CVSS 6.3 (medium), 2025-03-17: A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder.…
• CVE-2025-25474 - CVSS 6.5 (medium), 2025-02-18: DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h.
• CVE-2025-25472 - CVSS 5.3 (medium), 2025-02-18: A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file.
• CVE-2025-25475 - CVSS 7.5 (high), 2025-02-18: A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM…
• CVE-2024-52333 - CVSS 8.4 (high), 2025-01-13: An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to…
• CVE-2024-47796 - CVSS 8.4 (high), 2025-01-13: An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an…
• CVE-2024-27628 - CVSS 8.1 (high), 2024-06-28: Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
• CVE-2024-34509 - CVSS 5.3 (medium), 2024-05-05: dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
• CVE-2024-34508 - CVSS 4.3 (medium), 2024-05-05: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
• CVE-2024-28130 - CVSS 7.5 (high), 2024-04-23: An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted…
• CVE-2022-43272 - CVSS 7.5 (high), 2022-12-02: DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.
• CVE-2021-41689 - CVSS 7.5 (high), 2022-06-28: DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result…
• CVE-2021-41688 - CVSS 7.5 (high), 2022-06-28: DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific…
• CVE-2021-41687 - CVSS 7.5 (high), 2022-06-28: DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing.…